Device for monitoring a space by series-connected normally-open contacts, in particular cover interlock switches in a security enclosure

ABSTRACT

A device for monitoring a space by changing a sequence of a serial interconnection of closing contacts, in particular of cover switches in a security housing, having a series circuit variation apparatus, a security cover, at least two closing contacts, and a protective circuit, wherein said at least two closing contacts each have an open, electrically nonconductive state and a closed, electrically conductive state, wherein said security cover is set up to put each of said at least two closing contacts in a closed, electrically conductive state, wherein said protective circuit is set up to detect an opening of at least one of said at least two closing contacts, wherein said series circuit variation apparatus serially interconnects said at least two closing contacts, wherein the sequence of the serial interconnection of said at least two closing contacts can be changed by said series circuit variation apparatus.

REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of the filing date of German PatentApplication No. 10 2007 057 477.2 filed on 29 Nov. 2007, the disclosureof which application is hereby incorporated herein by reference.

The invention relates to a device for monitoring a space byseries-connected normally-open contacts, a method for monitoring a spaceby series-connected normally-open contacts, and the use of a device formonitoring a space by series-connected normally-open contacts tosafeguard a terminal for electronic payment transactions.

Terminals for electronic payment transactions are often covered andhence protected by a mechanical security cover, for example in the formof a dimensionally stable cover. The security cover shifts a pluralityof normally-open contacts, which are also referred to as cover interlockswitches or enclosure switches, into a closed, electrically conductingstate, and keeps said contacts in this state.

Today's systems usually contain two to three of these normally-opencontacts, which are connected in series. A deployed pull-down resistor,for example, is used here to detect the opening of a normally-opencontact.

Security requirements are growing in the face of increasing attacks onterminals or their keyboards. For normally-open contacts lying inseries, it may be sufficient to connect the start point of the seriescircuit to the end point, or to apply an external level to the endpoint, in order to disable detection of the normally-open contact stateof the normally-open contacts. Hence for three normally-open contacts,it may be sufficient to attack just one or two points instead of six.

In another conventional embodiment, the normally-open contacts may befed in parallel to a multiple logic gate, whereby the output onlyoutputs an “OK” signal when all the normally-open contacts in theparallel branches are closed. This increases the power consumption ofthe sensor circuitry, which in turn reduces the lifetime, for instance,of a battery used for the power supply.

It is an object of the invention to provide a device and a method formonitoring a space, said device and method having enhanced securityfeatures and hence increased security.

This object may be achieved by a device for monitoring a space byvarying a sequence of a series connection of normally-open contacts, bya method for varying a sequence of a series connection of normally-opencontacts, and by the use of a device for monitoring a space by varying asequence of a series connection of normally-open contacts to safeguard aterminal for electronic payment transactions, having the features of theindependent claims.

According to an exemplary embodiment of the present invention, a deviceis provided for monitoring a space by varying a sequence of a seriesconnection of normally-open contacts, in particular of cover interlockswitches in a security enclosure, said device comprising aseries-connection variation device, a security cover, at least twonormally-open contacts and a protective circuit, said at least twonormally-open contacts each having an open, electrically non-conductingstate and a closed, electrically conducting state, said security coverbeing configured to shift each of the at least two normally-opencontacts into a closed, electrically-conducting state in each case, saidprotective circuit being configured to detect an opening of at least oneof the at least two normally-open contacts, said series-connectionvariation device connecting in series the at least two normally-opencontacts, it being possible to vary the sequence of the seriesconnection of the at least two normally-open contacts by theseries-connection variation device.

According to a further exemplary embodiment of the present invention, amethod is provided for varying a sequence of a series connection ofnormally-open contacts, said method comprising the steps of seriesconnecting of at least two normally-open contacts using aseries-connection variation device, of varying the sequence of theseries connection of at least two normally-open contacts using theseries-connection variation device, of closing each of the at least twonormally-open contacts in an electrically conducting state using asecurity cover and of detecting the closure status of each of the atleast two normally-open contacts using a protective circuit.

According to a further exemplary embodiment of the present invention,the device for monitoring a space by varying a sequence of a seriesconnection of normally-open contacts is used to safeguard a terminal forelectronic payment transactions.

The following definitions are used in the present patent application.

Series-Connection Variation Device:

In the context of the present invention, a series-connection variationdevice may be understood to mean any facility for connecting together inseries a plurality of components, in particular at least twonormally-open contacts, so that they lie in series, i.e. one after theother, as regards a possible current flow or logic flow. In addition,the series-connection variation device may be configured to vary thesequence, i.e. the order, of the components. This may be done, forexample, by simply switching over conductor paths or by a more complexlogic circuit or the like. Reversing the polarity, in other wordsreversing the current flow or logic flow in at least one element, mayalso be realised here.

Security Cover:

In the context of the present invention, a security cover may beunderstood to mean any cover that is suitable, owing to its geometric,mechanical and/or electrical design, to hinder or prevent access to anelectronic circuit lying e.g. beneath or behind it, or at least todetect or provide means to detect such access. The security cover mayhere, for example, prevent access mechanically purely as a result of thematerial chosen for it (impact-proof plastic, metal etc.), or enableaccess to be detected by using a suitable design, for instance by usinginserted or applied conductor paths, wires or the like. Of course, it isalso possible to combine detection and protection.

Protective Circuit:

In the context of the present invention, a protective circuit may beunderstood to mean any means that are suitable to detect an opening ofnormally-open contacts or even (not dealt with in further detail in thefollowing description) a closure of normally-open contacts (acombination of the two is possible), to evaluate said opening or closingand/or subsequently to initiate further actions, such as triggering analarm and/or sending a signal to other components or elements.

According to an exemplary embodiment of the present invention, by way ofillustration, a device is provided for monitoring a space, in particularfor monitoring cover interlock switches in a security enclosure, forexample to safeguard a terminal for electronic payment transactions,said device having enhanced security features.

The device according to the invention may be used, for example, on Pointof Sales (POS) pin pads, or also on suitable pin pads in automaticteller machines.

In this case, electronic circuitry that is disposed in a space to bemonitored and e.g. stores and/or processes critical data may beprotected from unauthorized access by a security cover.

The security cover here may cover the space to be protected and may alsoactuate at least one normally-open contact, although preferably twonormally-open contacts.

The closure status of the normally-open contacts may in turn bemonitored by a protective circuit, which may detect if at least one ofthe normally-open contacts is opened.

Safeguarding the electronic circuitry by the security cover may be aneffective means of detecting and/or preventing direct access to theelectronic circuitry underneath it.

In this case, as an alternative to a parallel connection of thenormally-open contacts, a series connection of the normally-opencontacts may be used, it being possible to vary said series connectionin a controlled manner, in order to increase the protection of thedevice against tampering attempts or removal of the security cover.

The sequence of the normally-open contacts may be varied cyclicallyhere, so that a potential attacker may be unable to identify and attackthe start and end of the series circuit.

The cyclical variation of the sequence of the series connection ofnormally-open contacts according to the present invention may also beunderstood to mean a defined, repeating variation of the end point ofthe series circuit, i.e. the sequence of the series connection of thenormally-open contacts.

This cyclical variation of the sequence may mean that it may no longerbe sufficient for a potential attacker to attack or to bridge just onepoint, namely the end point, for instance, or even just two points, thestart and end point, because it may be possible to detect this attackwhen the sequence of the series connection of normally-open contacts isvaried cyclically, owing to the fact that the start and end points ofthe series circuit may vary over time.

In fact for a tamper attempt it may be now necessary to bridge everysingle normally-open contact on its own, which would significantlyincrease the complexity of such an attack.

In addition, a random variation of the sequence of the series connectionof normally-open contacts may be possible.

It therefore provides an effective means of preventing a PersonalIdentification Number (PIN) being obtained by spying, for example. As apossible response to detecting a removal of the security cover or evenjust the attempt to remove it, the protective circuit may initiatefurther actions, which include, for example, triggering an alarm or elsethe immediate erasure of program elements stored in electroniccomponents, in order thereby to render unusable a card reader, pin padand/or terminal for electronic payment transactions and, for example, tocall for servicing.

Further exemplary embodiments follow from the dependent claims.

Exemplary embodiments of the device according to the invention formonitoring a space by varying a sequence of a series connection ofnormally-open contacts are described below. Features of the describedembodiments also apply analogously, however, to the method for varying asequence of a series connection of normally-open contacts, and to theuse of a device for monitoring a space by varying a sequence of a seriesconnection of normally-open contacts to safeguard a terminal forelectronic payment transactions.

According to a further exemplary embodiment of the present invention,the device according to the invention also has a printed circuit board,said printed circuit board having a protected area disposed under thesecurity cover, where at least one of the elements of the groupcomprising series-connection variation device, normally-open contact andprotective-circuit components is arranged in the protected area.

A simple and low-cost option for the design and build of the deviceaccording to the invention may be provided by the design of the devicewith a printed circuit board. A protected area may be understood belowto mean an area that may be protected from external access by enhancedmeasures, or it may be possible to detect an unauthorized externalaccess. Such a security cover may constitute purely mechanicalprotection, for example by making it out of metal, hard plastic orimpact-proof plastic, or may include enhanced measures such as applyingor inserting conductor paths or wires into the security cover, which maybe disconnected or severed by unauthorized external access and henceenable detection of the unauthorized access.

According to a further exemplary embodiment of the present invention,the sequence of the series connection of the at least two normally-opencontacts can be varied cyclically by the series-connection variationdevice.

A simple and, in particular, simple-to-detect cyclic progression, i.e. asequence that repeats in a defined way, in the variation of the sequenceof the series connection of the at least two normally-open contacts maybe implemented in this way. Such a cyclical variation may be implementedsimply, and, in particular, may be realised by a simple embodiment ofthe variation specification.

In addition, by a corresponding cyclical realisation, a simpleimplementation of the variation of the sequence may be achieved, forexample, by simple look-up tables.

According to a further exemplary embodiment of the present invention,the sequence of the series connection of the at least two normally-opencontacts can be varied in defined time intervals, in particular lessthan 1 millisecond, in addition in particular less than 200microseconds.

Such an embodiment of the time intervals may particularly hinder apotential attacker in starting an attack, in particular actually inresponding to a corresponding variation of the sequence, and hence maysignificantly additionally increase the security of the presentinvention.

According to a further exemplary embodiment of the present invention,the normally-open contacts are designed as an element of the groupcomprising switching element, switch, momentary-contact element orpush-button, momentary-contact switch, dip-fix switch element andcarbon-contact dome having associated contacts.

Using such an element as a normally-open contact may enable thenormally-open contacts to be closed in a simple manner that is not proneto errors, and hence may be effective in reducing the risk of falsealarms. In addition, a simple and low-cost design of the deviceaccording to the invention may be possible using such elements.

According to a further exemplary embodiment of the present invention,the series-connection variation device comprises a microprocessor and amultiplexer/demultiplexer element, where the multiplexer/demultiplexerelement may be controlled by the microprocessor.

The embodiment of the series-connection variation device as acombination of microprocessor and multiplexer/demultiplexer element mayenable the series connection and the variation of the sequence of theseries connection of the normally-open contacts to be implementedsimply. By controlling the multiplexer/demultiplexer element by themicroprocessor, the series connection and the variation of the sequenceof the series connection may be performed substantially by or in themultiplexer/demultiplexer element.

According to a further exemplary embodiment of the present invention,the device also comprises an analogue switch element, where the analogueswitch element may be controlled using the same control signals from themicroprocessor as are used for controlling the multiplexer/demultiplexerelement, and where the sequence of the series connection of the at leasttwo normally-open contacts may be varied using themultiplexer/demultiplexer element and the analogue element.

Such an enhancement of the connection of the at least two normally-opencontacts may enable a simple enhancement in the connection sequence andalso additionally may hinder a potential attack. Overall, the integrityof the device according to the invention may be increased by this means.

An identical and parallel control of the multiplexer/demultiplexerelement and analogue switch element may mean that the analogue switchelement may be integrated simply in a logic table of the deviceaccording to the invention.

Exemplary embodiments of the invention are explained in greater detailbelow and illustrated in the following figures, in which:

FIG. 1 shows a schematic diagram of an exemplary implementation of adevice according to one embodiment of the present invention,

FIG. 2 shows a schematic diagram of an enhanced connection of threenormally-open contacts using multiplexer/demultiplexer elements for adevice according to one embodiment of the present invention,

FIG. 3 shows a schematic diagram of a connection of three normally-opencontacts using multiplexer/demultiplexer elements having reducedinterconnections for a device according to one embodiment of the presentinvention,

FIG. 4 shows a circuit diagram of an exemplary embodiment of a deviceaccording to one embodiment of the present invention,

FIG. 5 shows a schematic diagram of a device according to the prior artfor safeguarding n terminal for electronic payment transactions.

Identical or similar components in different figures are denoted by thesame reference signs.

The figures use schematic representations that are not to scale.

A schematic diagram of an exemplary implementation of a device 100according to one embodiment of the present invention is described belowwith reference to FIG. 1.

The device 100 according to the invention has a space or protected area1 disposed under a security cover 102. When in a closed and henceprotected state, the security cover 102 holds the two exemplarynormally-open contacts 2 a,b in a closed, electrically conducting state.The security cover 102, as already mentioned, may be made of metal,impact-proof plastic or the like and hence mechanically prevent or atleast hinder access to the space 1.

Correct placement of the security cover 102 is ensured by thenormally-open contacts 2 a,b, more precisely by their closed, conductingstate.

The series-connection variation device 101 connects the twonormally-open contacts 2 a,b in series using the sketched signal-linepairs 103 a,b, for example conductor paths, cables or the like.

The series-connection variation device 101 now continuously variesinternally the series connection of the normally-open contacts 2 a,b,for example at an interval of approximately 200 microseconds.

If it is detected that one of the contacts has been opened, i.e. thedevice has been attacked, then the protective circuit 3 is actuated ortriggered via signal line 104, and may subsequently take actions (notdescribed in further detail) to respond adequately to the attack.

An enhanced connection of three normally-open contacts 2 a,b,c usingmultiplexer/demultiplexer elements 4 is described below with referenceto FIG. 2.

The multiplexer/demultiplexer elements 4 in FIG. 2 may be operated indemultiplex mode and may switch the sequence of the three normally-opencontacts 2 a,b,c as a function of the individual control signals, whichmay assume the states “0” to “5” as shown.

In the schematic diagram of FIG. 2, a signal may be input to theenhanced connection at the point “in” and may leave it at the point“out”. The order or sequence amongst the normally-open contacts 2 a,b,cmay then be defined subsequently by the control of themultiplexer/demultiplexer elements 4 by their states “0” to “5”.

The connections in the states “0” and “4” are described below by way ofexample.

In control state “0”, the signal may be input via “in” to the firstmultiplexer/demultiplexer element 4. Then it may be output via theoutput of the first multiplexer/demultiplexer element 4, which isassigned the “0”, and may subsequently reaches the normally-open contactSW1 2 a.

At the second multiplexer/demultiplexer element 4, the signal may inturn be routed via the output assigned to the zero state, and hence mayreach the normally-open contact SW2 2 b.

At the third multiplexer/demultiplexer element 4, the input may also beswitched through to output “0”, the signal may arrive at thenormally-open contact SW3 2 c, and then at the fourthmultiplexer/demultiplexer element 4 may be routed again via output “0”to the common output of the connection circuitry shown in FIG. 2.

Hence in control state “0”, the connection of the normally-open contacts2 a,b,c may result in SW1-SW2-SW3.

In control state 4 now being described, the respective input of themultiplexer/demultiplexer elements 4 shown in FIG. 2 may be connectedthrough to the respective output 4.

Hence the common input may be taken by the firstmultiplexer/demultiplexer element 4 to the normally-open contact SW3 2c, and this is in turn routed via output 4 of the fourthmultiplexer/demultiplexer element 4 to the normally-open contact SW1 2a. The connection to normally-open contact SW2 2 b may be made viaoutput 4 of the second multiplexer/demultiplexer element 4. In the statebeing described, output 4 of the third multiplexer/demultiplexer element4 may then be connected to the common output of the connection shown inFIG. 2, so that a normally-open contact sequence SW3-SW1-SW2 is obtainedin control state 4.

The table below shows possible sequences of the normally-open contactsof FIG. 2:

MUX/DEMUX Sequence of control signal normally-open contacts 0SW1-SW2-SW3 1 SW1-SW3-SW2 2 SW2-SW3-SW1 3 SW2-SW1-SW3 4 SW3-SW1-SW2 5SW3-SW2-SW1

A device for monitoring a space by varying a sequence of a seriesconnection of normally-open contacts results in an increase in securitybecause a successful attack regularly needs to connect the input contactof the first normally-open contact of the series connection of thenormally-open contacts to the output contact of the last normally-opencontact in order thereby to bridge the entire set of normally-opencontacts.

In such a variation of the sequence of the series connection ofnormally-open contacts, the sequence itself can no longer be identifiedobviously, which may provide an effective means of preventing an attackof the type just described.

An attack on the output contact of the last normally-open contact,which, for such an attack, may be used so as to apply a level that wouldtake the output constantly to “ok”, hence may fail because of the factthat when varying the sequence of the series connection of normally-opencontacts, the normally-open contact located last in the sequence alsovaries continuously.

A connection of three normally-open contacts usingmultiplexer/demultiplexer elements having reduced interconnections isdescribed below with reference to FIG. 3.

In order to provide an effective means of preventing the two potentialattacks described above, it may be sufficient first to vary the sequenceof the series connection of the normally-open contacts and second toplace each normally-open contact at the end of the series connectiononce in a cyclic progression. FIG. 3 shows a possible implementation ofthese two conditions using reduced interconnections.

In the implementation shown in FIG. 3, the sequence of the normally-opencontacts 2 a,b,c may now rather be understood to mean “shifted to theleft” in each case, so that each normally-open contact 2 a,b,c isapplied to the common output of the connection once per cycle.

The table below shows the cyclical connection resulting from FIG. 3:

MUX/DEMUX Sequence of control signal normally-open contacts 0SW1-SW2-SW3 1 SW2-SW3-SW1 2 SW3-SW1-SW2

Such an implementation having reduced interconnections may be aneffective means of reducing the design requirements while still meetingthe conditions required for increased security.

An exemplary embodiment of the device for monitoring a space by varyinga sequence of a series connection of normally-open contacts is describedbelow with reference to FIG. 4.

The components used here are purely by way of example and are notrestrictive.

FIG. 4 shows a device for monitoring a space 1 by varying a sequence ofa series connection of normally-open contacts 2 a,b,c.

The circuit comprises a multiplexer/demultiplexer element 4, which hereis implemented as a dual multiplexer/demultiplexer element by way ofexample. Hence it comprises two independent multiplexer/demultiplexerelement units.

An analogue switch element 7 is also used to implement the connection.

Both the multiplexer/demultiplexer element 4 and the analogue switchelement 7 are controlled by the microprocessor 5, and specifically hereby its control outputs RA0 and RA1.

The two control outputs are taken via the two resistors R16 and R17respectively in parallel to the inputs A0 and A1 of themultiplexer/demultiplexer element 4 and IN1 and IN2 of the analogueswitch element 7.

Hence multiplexer/demultiplexer element 4 and analogue switch element 7are controlled in parallel. The output signal 8 of the device formonitoring a space by varying a sequence of a series connection ofnormally-open contacts is taken in parallel to the protective circuit 3and is simultaneously sent via resistor R24 to the microprocessor viaits input RB0.

On detecting an unauthorized external access, for example bydisconnection of at least one normally-open contact, the microprocessor(via RB0) and/or the protective circuit detect this and initiate furtheractions, such as emitting an alarm or erasing at least portions of thefirmware of the device and hence putting the device into an unusablestate.

The three normally-open contacts 2 a,b,c, which are shown here as S1-A,S1-B and S2-A, are varied in sequence cyclically in accordance with thediagram and specification represented in FIG. 3.

It therefore results in the connection shown below:

MUX/DEMUX Sequence of control signal normally-open contacts 0 S1-A -S1-B - S2-A 1 S1-B - S2-A - S1-A 2 S2-A - S1-A - S1-B

A schematic diagram of a device for safeguarding a terminal forelectronic payment transactions according to the prior art is describedbelow with reference to FIG. 5.

FIG. 5 shows the series connection of the three normally-open contactsS1 to S3, 2 a,b,c.

If each of the three normally-open contacts 2 a,b,c is in a closedstate, then the circuit of FIG. 5 may exhibit at the point TPA 14 avalue that corresponds to the protected, normal state, for example alogic “1”.

Alternatively, if just one normally-open contact 2 a,b,c is open, pointTPA 14 may exhibit a value that corresponds to an attacked state, forexample a logic “0”, and hence to a fault state.

A protective circuit 3 (not shown in greater detail in FIG. 5), whichmay also be connected to the point TPA 14 for example, using therespective logic state “0” or “1”, may detect the integrity of asecurity cover, said security cover closing each of the individualnormally-open contacts 2 a,b,c, and hence connecting them in anelectrically conducting manner, when in the protected state.

If, as a result of an attack, just one of the three normally-opencontacts 2 a,b,c is disconnected, then the logic value at point TPA 14may change from normal state “1” to fault state “0”. The protectivecircuit may detect this change and initiate further actions.

As FIG. 5 shows, an attack on the device according to the prior art maybe possible by simply connecting/shorting together the points TPA 12 andTPA 13 shown in the figure. An attack may equally be possible by simplyapplying a suitable signal to the point TPA 13 in order to hold thepoint TPA 14 continuously in the “1” state.

An attack of this type need not necessarily be made on at least one ofthe points TPA 12, TPA 13, TPA 14, but may also be made on thenormally-open contacts themselves.

The invention is not restricted in its implementation to the preferredembodiments shown in the figures. In fact a multiplicity of variants arepossible that make use of the presented solution and principle accordingto the invention, even in fundamentally different embodiments.

The description of the present invention consistently refers todetecting the opening of a normally-open contact. The use of equivalentimplementations, in which normally-open contacts are closed in the eventof an attack, is equally possible, however, as is a combination of thetwo variants.

For the sake of completeness, it should be mentioned that the terms“having” and “comprising” do not exclude other elements or steps, and“a” does not exclude a multiplicity. In addition, it should be mentionedthat features or steps, which have been described with reference to oneof the above exemplary embodiments, can also be used in combination withother features or steps of other exemplary embodiments described above.Reference signs in the claims shall not be considered as restrictive.

List of references  1 space, protected area  2a, b, c normally-opencontacts  3 protective circuit  4 multiplexer/demultiplexer element  5microprocessor  6 analogue switch element  7 common output of the devicefor monitoring a space by varying a sequence of a series connection ofnormally-open contacts 100 device for monitoring a space by varying asequence of a series connection of normally-open contacts 101series-connection variation device 102 protective cover 103a ,bsignal-line pairs 104 signal line

The invention claimed is:
 1. Device for monitoring a space by varying asequence of a series connection of normally-open contacts, in particularof cover interlock switches in a security enclosure, comprising aseries-connection variation device; a security cover; at least twonormally-open contacts; and a protective circuit; said at least twonormally-open contacts each having an open, electrically non-conductingstate and a closed, electrically conducting state; said security coverbeing configured to shift each of the at least two normally-opencontacts into a closed, electrically-conducting state in each case; saidprotective circuit being configured to detect an opening of at least oneof the at least two normally-open contacts; said series-connectionvariation device connecting in series the at least two normally-opencontacts; it being possible to vary the sequence of the seriesconnection of the at least two normally-open contacts by theseries-connection variation device.
 2. Device according to claim 1,further comprising a circuit board, having a protected area disposedunder the security cover, wherein at least one of the elements of thegroup comprising series-connection variation device, normally-opencontact and protective circuit is arranged in the protected area. 3.Device according to claim 1, wherein the sequence of the seriesconnection of the at least two normally-open contacts can be variedcyclically by the series-connection variation device.
 4. Deviceaccording to claim 1, where the sequence of the series connection of theat least two normally-open contacts can be varied in defined timeintervals, in particular less than one millisecond, in addition inparticular less than 200 microseconds.
 5. Device according to claim 1,wherein the normally-open contacts are designed as an element of thegroup comprising switching element, switch, momentary-contact element,momentary-contact switch, dip-fix switch element and carbon-contact domehaving associated contacts.
 6. Device according to claim 1, wherein theseries-connection variation device comprises a microprocessor; and amultiplexer/demultiplexer element; where the multiplexer/demultiplexerelement can be controlled by the microprocessor.
 7. Device according toclaim 6, where the series-connection variation device also comprises ananalogue switch element, wherein the analogue switch element can becontrolled using the same control signals from the microprocessor as areused for controlling the multiplexer/demultiplexer element, and whereinthe sequence of the series connection of the at least two normally-opencontacts can be varied using the multiplexer/demultiplexer element andthe analogue switch element.
 8. Use of a device according to any ofclaim 1 to safeguard a terminal for electronic payment transactions. 9.Method for varying a sequence of a series connection of normally-opencontacts, comprising the steps series connection of at least twonormally-open contacts using a series-connection variation device;varying the sequence of the series connection of at least twonormally-open contacts using the series-connection variation device;closing each of the at least two normally-open contacts in anelectrically conducting state using a security cover; and detecting theclosure status of each of the at least two normally-open contacts usinga protective circuit.
 10. Method according to claim 9, wherein theseries connection of the at least two normally-open contacts is variedcyclically.
 11. Method according to claim 9, wherein the seriesconnection of the at least two normally-open contacts is varied indefined time intervals, in particular less than one millisecond, inaddition in particular less than 200 microseconds.
 12. Method accordingto claim 9, wherein the sequence of the series connection of the atleast two normally-open contacts is varied using a microprocessor and amultiplexer/demultiplexer element.
 13. Method according to claim 12,wherein the sequence of the series connection of the at least twonormally-open contacts is varied using the multiplexer/demultiplexerelement and an analogue switch element wherein the analogue switchelement is controlled using the same control signals from themicroprocessor as are used for controlling the multiplexer/demultiplexerelement.